[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71G3N8M80F07SF8W7VV5XCT":3,"skill-same:01M71G3N8M80F07SF8W7VV5XCT":96},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":69,"commitSha":70,"skillDirectory":71,"forksCount":14,"repositoryHtmlUrl":72,"repositoryHomepageUrl":6,"ownerHtmlUrl":73,"ownerBlogUrl":6,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M71G3N8M80F07SF8W7VV5XCT","exercise-tabletop-execute-exploit",null,"Performs tabletop exercises for SOC teams simulating security incidents through discussion-based scenarios to test incident response procedures, communication workflows, and decision-making under pressure without impacting production systems. Use when organizations need to validate IR playbooks, train analysts, or meet compliance requirements for incident response testing.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsoc\u002Fexercise\u002Ftabletop\u002Fexecute\u002Fexploit\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"exercise tabletop execute exploit","exploit","execute","tabletop","exercise","playbook-validation","when","Meet","incident","cm","decision","Bash","testing","t1566","t1078","soc","training","workflows","incident response","cybersecurity","2026-11-10 10:12:30",false,"---\nname: exercise-tabletop-execute-exploit\ndescription: Performs tabletop exercises for SOC teams simulating security incidents through discussion-based scenarios to test incident response procedures, communication workflows, and decision-making under pressure without impacting production systems. Use when organizations need to validate IR playbooks, train analysts, or meet compliance requirements for incident response testing.\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- soc\n- tabletop\n- exercise\n- incident-response\n- training\n- nist\n- playbook-validation\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1566\n- T1486\n- T1078\ncapec: []\n---\n\n# Performing SOC Tabletop Exercise\n\n## When to Use\n\nUse this skill when:\n- Annual or semi-annual incident response testing is required (NIST, ISO 27001, PCI DSS compliance)\n- New SOC analysts need exposure to major incident scenarios in a controlled environment\n- Updated playbooks need validation before next real incident\n- Cross-functional coordination (SOC, IT, Legal, PR, Executive) needs rehearsal\n- Post-incident reviews reveal gaps requiring scenario-based training\n\n**Do not use** as a replacement for technical purple team exercises — tabletop exercises test processes and decision-making, not technical detection capabilities.\n\n## Prerequisites\n\n- Exercise facilitator with incident response experience\n- Participant list: SOC analysts (Tier 1-3), SOC manager, IT operations, Legal, HR, Communications\n- Conference room or video call with screen sharing capability\n- Printed or digital scenario injects with timed release schedule\n- Evaluation scorecard for assessing participant responses\n- Existing incident response plan and playbooks for reference during exercise\n\n## Workflow\n\n### Step 1: Design Exercise Scenario\n\nCreate a realistic multi-phase scenario with escalating complexity:\n\n```yaml\ntabletop_exercise:\n  title: \"Operation Dark Harvest — Ransomware Attack Scenario\"\n  exercise_id: TTX-2024-Q1\n  date: 2024-03-22\n  duration: 3 hours (09:00-12:00)\n  classification: TLP:AMBER (internal use only)\n\n  objectives:\n    1: \"Test SOC team's ability to detect and triage ransomware indicators\"\n    2: \"Validate escalation procedures from Tier 1 to incident commander\"\n    3: \"Assess cross-functional communication with Legal, PR, and Executive leadership\"\n    4: \"Evaluate containment decision-making under time pressure\"\n    5: \"Test backup recovery procedures and business continuity activation\"\n\n  participants:\n    - role: SOC Tier 1 Analyst (2 participants)\n    - role: SOC Tier 2 Analyst (2 participants)\n    - role: SOC Manager \u002F Incident Commander\n    - role: IT Operations Lead\n    - role: CISO (or delegate)\n    - role: Legal Counsel\n    - role: Communications \u002F PR\n    - role: Business Unit Leader (Finance)\n\n  scenario_background: >\n    Your organization is a mid-size financial services company with 2,500 employees.\n    The SOC operates 24\u002F7 with 6 analysts per shift using Splunk ES and CrowdStrike Falcon.\n    It is Friday afternoon at 3:45 PM. The weekend IT skeleton crew starts at 5 PM.\n```\n\n### Step 2: Create Timed Injects\n\nDesign scenario injects released at scheduled intervals:\n\n```yaml\ninjects:\n\n  inject_1:\n    time: \"T+0 (3:45 PM)\"\n    title: \"Initial Alert\"\n    content: >\n      Splunk ES generates a notable event: \"Shadow Copy Deletion Detected\"\n      on FILESERVER-03 (10.0.10.50, Finance Department file server).\n      The alert shows: vssadmin.exe delete shadows \u002Fall \u002Fquiet\n      Source user: svc_backup (service account)\n      This is the first alert from this host today.\n    questions:\n      - \"What is your initial assessment of this alert?\"\n      - \"What additional data would you query in Splunk?\"\n      - \"Is this a Tier 1 triage item or immediate escalation?\"\n\n  inject_2:\n    time: \"T+10 minutes\"\n    title: \"Escalating Indicators\"\n    content: >\n      While investigating the first alert, two more alerts fire:\n      1. \"Mass File Modification Detected\" — 2,847 files renamed with .locked extension\n         on FILESERVER-03 within 5 minutes\n      2. \"Suspicious PowerShell Encoded Command\" on WORKSTATION-118 (10.0.5.118)\n         — same svc_backup account used\n      CrowdStrike shows process tree: explorer.exe > cmd.exe > powershell.exe -enc [base64]\n    questions:\n      - \"What is your updated assessment? What incident severity would you assign?\"\n      - \"What immediate containment actions would you take?\"\n      - \"Who needs to be notified at this point?\"\n      - \"How do you determine if this is confined to these two hosts?\"\n\n  inject_3:\n    time: \"T+25 minutes\"\n    title: \"Scope Expansion\"\n    content: >\n      Enterprise-wide Splunk search reveals:\n      - 7 additional hosts showing .locked file extensions\n      - All affected hosts are in the Finance VLAN (10.0.10.0\u002F24)\n      - svc_backup account was used to RDP to all affected hosts starting at 3:30 PM\n      - A ransom note \"README_UNLOCK.txt\" found on all affected hosts\n      - Ransom note demands 50 BTC, includes Tor payment portal link\n      - IT reports the svc_backup password was changed 2 days ago (not by IT team)\n    questions:\n      - \"This is now a confirmed ransomware incident. What is your incident classification?\"\n      - \"Walk through your containment strategy — what do you isolate and in what order?\"\n      - \"Should you shut down the Finance VLAN entirely? What are the trade-offs?\"\n      - \"When and how do you notify executive leadership?\"\n\n  inject_4:\n    time: \"T+45 minutes\"\n    title: \"Business Impact and External Pressure\"\n    content: >\n      The CFO calls the SOC Manager directly:\n      \"We are closing the quarter-end books this weekend. Finance absolutely needs\n      access to FILESERVER-03 by Monday morning or we miss SEC filing deadlines.\"\n      Additionally:\n      - Legal asks if customer PII was on any affected servers\n      - PR reports a journalist called asking about \"cybersecurity issues at [company]\"\n      - The ransom note deadline is 48 hours\n      - IT reports last verified backup of FILESERVER-03 is from Wednesday (3 days old)\n    questions:\n      - \"How do you balance containment security with business pressure from the CFO?\"\n      - \"What is your recommendation on ransom payment? Who makes this decision?\"\n      - \"What information does Legal need to assess breach notification obligations?\"\n      - \"How do you handle the media inquiry?\"\n      - \"Can you recover from the 3-day-old backup? What data is lost?\"\n\n  inject_5:\n    time: \"T+70 minutes\"\n    title: \"Forensic Discovery\"\n    content: >\n      Tier 3 forensic analysis reveals:\n      - Initial access was via compromised VPN credentials (svc_backup)\n      - Credentials were found in a dark web dump from a third-party vendor breach\n      - Attacker had access for 5 days before deploying ransomware\n      - Evidence of data exfiltration: 15GB uploaded to Mega.nz over 3 days\n      - Exfiltrated data includes customer PII (SSN, account numbers) for 12,000 clients\n      - The ransomware variant is identified as LockBit 3.0\n    questions:\n      - \"How does confirmed data exfiltration change your response?\"\n      - \"What are the regulatory notification requirements? (SEC, state breach laws)\"\n      - \"What is the timeline for customer notification?\"\n      - \"Should you engage external IR firm? Law enforcement?\"\n      - \"How do you handle the vendor who was the source of the credential compromise?\"\n\n  inject_6:\n    time: \"T+90 minutes\"\n    title: \"Recovery Decision Point\"\n    content: >\n      You are now 6 hours into the incident. Status:\n      - All 9 affected hosts isolated\n      - Finance VLAN segmented from corporate network\n      - LockBit C2 domain blocked at firewall and DNS\n      - No decryptor available for LockBit 3.0\n      - Wednesday backup verified clean but 3 days of data missing\n      - CEO asks for a full situation briefing in 30 minutes\n    questions:\n      - \"Prepare a 5-minute executive briefing. What do you include?\"\n      - \"What is your recovery plan and estimated timeline?\"\n      - \"What monitoring will you put in place during and after recovery?\"\n      - \"What immediate security improvements would you recommend?\"\n```\n\n### Step 3: Facilitate the Exercise\n\n**Facilitator Guide:**\n\n```\nEXERCISE FACILITATION PROTOCOL\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n1. OPENING (10 min)\n   - State exercise objectives and ground rules\n   - Emphasize: \"No wrong answers — this is about testing process, not individuals\"\n   - Remind participants this is a simulation — no actual systems are affected\n   - Identify the exercise observer\u002Fscribe\n\n2. INJECT DELIVERY (110 min)\n   - Present each inject on screen, allow 2 min reading time\n   - Ask guided questions to each role group\n   - Allow discussion but keep on timeline\n   - Inject additional pressure\u002Fcomplications as needed\n   - Record decisions, rationale, and gaps identified\n\n3. DISCUSSION RULES\n   - Participants respond in-character (their actual role)\n   - Reference actual playbooks and procedures when available\n   - If participants are unsure, that IS the finding\n   - Facilitator may add \"hot injects\" if discussion stalls\n\n4. CLOSING (40 min)\n   - Hot wash: Each participant shares one thing that went well, one gap\n   - Facilitator summarizes key findings\n   - Identify top 5 action items with owners and due dates\n```\n\n### Step 4: Evaluate Participant Responses\n\nScore responses against expected outcomes:\n\n```yaml\nevaluation_criteria:\n\n  detection_and_triage:\n    expected: \"Immediately recognize shadow copy deletion as ransomware precursor\"\n    scoring:\n      excellent: \"Correctly identified within 2 minutes, initiated proper escalation\"\n      adequate: \"Identified after discussion, correct escalation path\"\n      needs_improvement: \"Did not recognize significance, delayed escalation\"\n\n  containment_decision:\n    expected: \"Isolate affected hosts via EDR, segment Finance VLAN, preserve evidence\"\n    scoring:\n      excellent: \"Immediate isolation, correct priority order, evidence preservation\"\n      adequate: \"Isolation performed but delayed or incomplete prioritization\"\n      needs_improvement: \"Considered powering off hosts (destroys evidence) or delayed isolation\"\n\n  communication:\n    expected: \"Timely notification chain: SOC Manager -> CISO -> Legal -> Executive\"\n    scoring:\n      excellent: \"Proper notification within defined SLAs, clear and concise briefings\"\n      adequate: \"Notifications made but slightly delayed or incomplete\"\n      needs_improvement: \"Key stakeholders not notified, unclear communication\"\n\n  business_continuity:\n    expected: \"Balance security containment with business recovery needs\"\n    scoring:\n      excellent: \"Realistic recovery timeline communicated, alternative workarounds proposed\"\n      adequate: \"Recovery discussed but timeline unclear\"\n      needs_improvement: \"Overcommitted on timeline or ignored business impact\"\n```\n\n### Step 5: Generate After-Action Report\n\n```yaml\nafter_action_report:\n  exercise: TTX-2024-Q1 \"Operation Dark Harvest\"\n  date: 2024-03-22\n  participants: 10\n  duration: 3 hours\n\n  executive_summary: >\n    The tabletop exercise tested the organization's ransomware response capabilities\n    across detection, containment, communication, and recovery phases. The SOC team\n    demonstrated strong technical triage skills but gaps were identified in cross-\n    functional communication and backup recovery procedures.\n\n  strengths:\n    - SOC analysts correctly identified ransomware indicators within first inject\n    - Containment decision-making was swift and technically sound\n    - Legal team was well-prepared on breach notification requirements\n    - IT operations had clear understanding of backup recovery procedures\n\n  gaps_identified:\n    - gap_1:\n        finding: \"No documented procedure for notifying CISO after-hours\"\n        risk: High\n        action: \"Update escalation contacts with personal phone numbers and backup contacts\"\n        owner: SOC Manager\n        due_date: 2024-04-05\n\n    - gap_2:\n        finding: \"Backup recovery testing has not been performed in 6 months\"\n        risk: Critical\n        action: \"Schedule quarterly backup restoration drill\"\n        owner: IT Operations Lead\n        due_date: 2024-04-15\n\n    - gap_3:\n        finding: \"No pre-approved media holding statement for cyber incidents\"\n        risk: Medium\n        action: \"Draft and approve 3 holding statement plugins with Legal\"\n        owner: Communications Lead\n        due_date: 2024-04-10\n\n    - gap_4:\n        finding: \"Service account (svc_backup) had Domain Admin privileges unnecessarily\"\n        risk: Critical\n        action: \"Audit all service accounts, implement least privilege\"\n        owner: IT Security\n        due_date: 2024-04-01\n\n    - gap_5:\n        finding: \"Unclear decision authority for ransom payment\"\n        risk: High\n        action: \"Document ransom payment decision tree with CEO\u002FBoard approval requirement\"\n        owner: CISO\n        due_date: 2024-04-15\n\n  metrics:\n    overall_score: \"72\u002F100 (Adequate)\"\n    detection: \"85\u002F100 (Excellent)\"\n    containment: \"80\u002F100 (Good)\"\n    communication: \"60\u002F100 (Needs Improvement)\"\n    recovery: \"65\u002F100 (Needs Improvement)\"\n\n  next_exercise: \"TTX-2024-Q2 — Data Breach \u002F Insider Threat Scenario (June 2024)\"\n```\n\n### Step 6: Track Remediation and Follow-Up\n\n```spl\n--- Track action items from tabletop exercise\n| inputlookup ttx_action_items.csv\n| eval days_remaining = round((strptime(due_date, \"%Y-%m-%d\") - now()) \u002F 86400)\n| eval status_flag = case(\n    status=\"Completed\", \"GREEN\",\n    days_remaining \u003C 0, \"RED — OVERDUE\",\n    days_remaining \u003C 7, \"YELLOW — DUE SOON\",\n    1=1, \"GREEN\"\n  )\n| sort - status_flag, days_remaining\n| table gap_id, finding, owner, due_date, days_remaining, status, status_flag\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Tabletop Exercise** | Discussion-based simulation where participants walk through incident scenarios without executing technical actions |\n| **Inject** | Scenario update introducing new information, complications, or decisions for participants to address |\n| **Hot Wash** | Immediate post-exercise debrief where participants share observations and initial lessons learned |\n| **After-Action Report (AAR)** | Formal document capturing exercise findings, gaps, strengths, and remediation action items |\n| **Facilitator** | Exercise leader who presents injects, guides discussion, and ensures objectives are met |\n| **Decision Point** | Moment in the scenario requiring participants to choose between options with trade-offs |\n\n## Tools & Systems\n\n- **FEMA HSEEP**: Homeland Security Exercise and Evaluation Program providing exercise planning methodology\n- **Tabletop Exercise Framework (NIST SP 800-84)**: NIST guide for planning and conducting IT security exercises\n- **Immersive Labs**: Platform for cybersecurity crisis simulation and tabletop exercise management\n- **Infection Monkey**: Open-source breach simulation for technical validation of tabletop findings\n- **Archer**: GRC platform for tracking exercise findings and remediation action items\n\n## Common Scenarios\n\n- **Ransomware Attack**: Multi-phase scenario testing detection, containment, ransom decision, and recovery\n- **Data Breach**: Customer PII exposure testing notification requirements, legal obligations, and PR response\n- **Supply Chain Compromise**: Third-party vendor breach impacting organizational systems and data\n- **Insider Threat**: Employee data theft scenario testing HR, Legal, and security team coordination\n- **Business Email Compromise**: CEO fraud wire transfer attempt testing financial controls and verification procedures\n\n## Output Format\n\n```\nTABLETOP EXERCISE SUMMARY — TTX-2024-Q1\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nScenario:     Operation Dark Harvest (Ransomware)\nDate:         2024-03-22 (09:00-12:00 UTC)\nParticipants: 10 (SOC: 5, IT: 1, Legal: 1, Comms: 1, Exec: 2)\nDuration:     3 hours (6 injects delivered)\n\nSCORES:\n  Detection & Triage:    85\u002F100  Excellent\n  Containment:           80\u002F100  Good\n  Communication:         60\u002F100  Needs Improvement\n  Recovery Planning:     65\u002F100  Needs Improvement\n  Overall:               72\u002F100  Adequate\n\nKEY FINDINGS:\n  [+] Strong: Ransomware indicators correctly identified immediately\n  [+] Strong: EDR isolation procedure well understood\n  [-] Gap: No after-hours CISO notification procedure\n  [-] Gap: Backup recovery untested for 6 months\n  [-] Gap: No pre-approved media statement templates\n  [-] Gap: Service account over-privileged (Domain Admin)\n  [-] Gap: Ransom payment decision authority undefined\n\nACTION ITEMS: 5 (Critical: 2, High: 2, Medium: 1)\nNEXT EXERCISE: TTX-2024-Q2 (June 2024) — Insider Threat Scenario\n```\n","# Performing SOC Tabletop Exercise\n\n## When to Use\n\nUse this skill when:\n- Annual or semi-annual incident response testing is required (NIST, ISO 27001, PCI DSS compliance)\n- New SOC analysts need exposure to major incident scenarios in a controlled environment\n- Updated playbooks need validation before next real incident\n- Cross-functional coordination (SOC, IT, Legal, PR, Executive) needs rehearsal\n- Post-incident reviews reveal gaps requiring scenario-based training\n\n**Do not use** as a replacement for technical purple team exercises — tabletop exercises test processes and decision-making, not technical detection capabilities.\n\n## Prerequisites\n\n- Exercise facilitator with incident response experience\n- Participant list: SOC analysts (Tier 1-3), SOC manager, IT operations, Legal, HR, Communications\n- Conference room or video call with screen sharing capability\n- Printed or digital scenario injects with timed release schedule\n- Evaluation scorecard for assessing participant responses\n- Existing incident response plan and playbooks for reference during exercise\n\n## Workflow\n\n### Step 1: Design Exercise Scenario\n\nCreate a realistic multi-phase scenario with escalating complexity:\n\n```yaml\ntabletop_exercise:\n  title: \"Operation Dark Harvest — Ransomware Attack Scenario\"\n  exercise_id: TTX-2024-Q1\n  date: 2024-03-22\n  duration: 3 hours (09:00-12:00)\n  classification: TLP:AMBER (internal use only)\n\n  objectives:\n    1: \"Test SOC team's ability to detect and triage ransomware indicators\"\n    2: \"Validate escalation procedures from Tier 1 to incident commander\"\n    3: \"Assess cross-functional communication with Legal, PR, and Executive leadership\"\n    4: \"Evaluate containment decision-making under time pressure\"\n    5: \"Test backup recovery procedures and business continuity activation\"\n\n  participants:\n    - role: SOC Tier 1 Analyst (2 participants)\n    - role: SOC Tier 2 Analyst (2 participants)\n    - role: SOC Manager \u002F Incident Commander\n    - role: IT Operations Lead\n    - role: CISO (or delegate)\n    - role: Legal Counsel\n    - role: Communications \u002F PR\n    - role: Business Unit Leader (Finance)\n\n  scenario_background: >\n    Your organization is a mid-size financial services company with 2,500 employees.\n    The SOC operates 24\u002F7 with 6 analysts per shift using Splunk ES and CrowdStrike Falcon.\n    It is Friday afternoon at 3:45 PM. The weekend IT skeleton crew starts at 5 PM.\n```\n\n### Step 2: Create Timed Injects\n\nDesign scenario injects released at scheduled intervals:\n\n```yaml\ninjects:\n\n  inject_1:\n    time: \"T+0 (3:45 PM)\"\n    title: \"Initial Alert\"\n    content: >\n      Splunk ES generates a notable event: \"Shadow Copy Deletion Detected\"\n      on FILESERVER-03 (10.0.10.50, Finance Department file server).\n      The alert shows: vssadmin.exe delete shadows \u002Fall \u002Fquiet\n      Source user: svc_backup (service account)\n      This is the first alert from this host today.\n    questions:\n      - \"What is your initial assessment of this alert?\"\n      - \"What additional data would you query in Splunk?\"\n      - \"Is this a Tier 1 triage item or immediate escalation?\"\n\n  inject_2:\n    time: \"T+10 minutes\"\n    title: \"Escalating Indicators\"\n    content: >\n      While investigating the first alert, two more alerts fire:\n      1. \"Mass File Modification Detected\" — 2,847 files renamed with .locked extension\n         on FILESERVER-03 within 5 minutes\n      2. \"Suspicious PowerShell Encoded Command\" on WORKSTATION-118 (10.0.5.118)\n         — same svc_backup account used\n      CrowdStrike shows process tree: explorer.exe > cmd.exe > powershell.exe -enc [base64]\n    questions:\n      - \"What is your updated assessment? What incident severity would you assign?\"\n      - \"What immediate containment actions would you take?\"\n      - \"Who needs to be notified at this point?\"\n      - \"How do you determine if this is confined to these two hosts?\"\n\n  inject_3:\n    time: \"T+25 minutes\"\n    title: \"Scope Expansion\"\n    content: >\n      Enterprise-wide Splunk search reveals:\n      - 7 additional hosts showing .locked file extensions\n      - All affected hosts are in the Finance VLAN (10.0.10.0\u002F24)\n      - svc_backup account was used to RDP to all affected hosts starting at 3:30 PM\n      - A ransom note \"README_UNLOCK.txt\" found on all affected hosts\n      - Ransom note demands 50 BTC, includes Tor payment portal link\n      - IT reports the svc_backup password was changed 2 days ago (not by IT team)\n    questions:\n      - \"This is now a confirmed ransomware incident. What is your incident classification?\"\n      - \"Walk through your containment strategy — what do you isolate and in what order?\"\n      - \"Should you shut down the Finance VLAN entirely? What are the trade-offs?\"\n      - \"When and how do you notify executive leadership?\"\n\n  inject_4:\n    time: \"T+45 minutes\"\n    title: \"Business Impact and External Pressure\"\n    content: >\n      The CFO calls the SOC Manager directly:\n      \"We are closing the quarter-end books this weekend. Finance absolutely needs\n      access to FILESERVER-03 by Monday morning or we miss SEC filing deadlines.\"\n      Additionally:\n      - Legal asks if customer PII was on any affected servers\n      - PR reports a journalist called asking about \"cybersecurity issues at [company]\"\n      - The ransom note deadline is 48 hours\n      - IT reports last verified backup of FILESERVER-03 is from Wednesday (3 days old)\n    questions:\n      - \"How do you balance containment security with business pressure from the CFO?\"\n      - \"What is your recommendation on ransom payment? Who makes this decision?\"\n      - \"What information does Legal need to assess breach notification obligations?\"\n      - \"How do you handle the media inquiry?\"\n      - \"Can you recover from the 3-day-old backup? What data is lost?\"\n\n  inject_5:\n    time: \"T+70 minutes\"\n    title: \"Forensic Discovery\"\n    content: >\n      Tier 3 forensic analysis reveals:\n      - Initial access was via compromised VPN credentials (svc_backup)\n      - Credentials were found in a dark web dump from a third-party vendor breach\n      - Attacker had access for 5 days before deploying ransomware\n      - Evidence of data exfiltration: 15GB uploaded to Mega.nz over 3 days\n      - Exfiltrated data includes customer PII (SSN, account numbers) for 12,000 clients\n      - The ransomware variant is identified as LockBit 3.0\n    questions:\n      - \"How does confirmed data exfiltration change your response?\"\n      - \"What are the regulatory notification requirements? (SEC, state breach laws)\"\n      - \"What is the timeline for customer notification?\"\n      - \"Should you engage external IR firm? Law enforcement?\"\n      - \"How do you handle the vendor who was the source of the credential compromise?\"\n\n  inject_6:\n    time: \"T+90 minutes\"\n    title: \"Recovery Decision Point\"\n    content: >\n      You are now 6 hours into the incident. Status:\n      - All 9 affected hosts isolated\n      - Finance VLAN segmented from corporate network\n      - LockBit C2 domain blocked at firewall and DNS\n      - No decryptor available for LockBit 3.0\n      - Wednesday backup verified clean but 3 days of data missing\n      - CEO asks for a full situation briefing in 30 minutes\n    questions:\n      - \"Prepare a 5-minute executive briefing. What do you include?\"\n      - \"What is your recovery plan and estimated timeline?\"\n      - \"What monitoring will you put in place during and after recovery?\"\n      - \"What immediate security improvements would you recommend?\"\n```\n\n### Step 3: Facilitate the Exercise\n\n**Facilitator Guide:**\n\n```\nEXERCISE FACILITATION PROTOCOL\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n1. OPENING (10 min)\n   - State exercise objectives and ground rules\n   - Emphasize: \"No wrong answers — this is about testing process, not individuals\"\n   - Remind participants this is a simulation — no actual systems are affected\n   - Identify the exercise observer\u002Fscribe\n\n2. INJECT DELIVERY (110 min)\n   - Present each inject on screen, allow 2 min reading time\n   - Ask guided questions to each role group\n   - Allow discussion but keep on timeline\n   - Inject additional pressure\u002Fcomplications as needed\n   - Record decisions, rationale, and gaps identified\n\n3. DISCUSSION RULES\n   - Participants respond in-character (their actual role)\n   - Reference actual playbooks and procedures when available\n   - If participants are unsure, that IS the finding\n   - Facilitator may add \"hot injects\" if discussion stalls\n\n4. CLOSING (40 min)\n   - Hot wash: Each participant shares one thing that went well, one gap\n   - Facilitator summarizes key findings\n   - Identify top 5 action items with owners and due dates\n```\n\n### Step 4: Evaluate Participant Responses\n\nScore responses against expected outcomes:\n\n```yaml\nevaluation_criteria:\n\n  detection_and_triage:\n    expected: \"Immediately recognize shadow copy deletion as ransomware precursor\"\n    scoring:\n      excellent: \"Correctly identified within 2 minutes, initiated proper escalation\"\n      adequate: \"Identified after discussion, correct escalation path\"\n      needs_improvement: \"Did not recognize significance, delayed escalation\"\n\n  containment_decision:\n    expected: \"Isolate affected hosts via EDR, segment Finance VLAN, preserve evidence\"\n    scoring:\n      excellent: \"Immediate isolation, correct priority order, evidence preservation\"\n      adequate: \"Isolation performed but delayed or incomplete prioritization\"\n      needs_improvement: \"Considered powering off hosts (destroys evidence) or delayed isolation\"\n\n  communication:\n    expected: \"Timely notification chain: SOC Manager -> CISO -> Legal -> Executive\"\n    scoring:\n      excellent: \"Proper notification within defined SLAs, clear and concise briefings\"\n      adequate: \"Notifications made but slightly delayed or incomplete\"\n      needs_improvement: \"Key stakeholders not notified, unclear communication\"\n\n  business_continuity:\n    expected: \"Balance security containment with business recovery needs\"\n    scoring:\n      excellent: \"Realistic recovery timeline communicated, alternative workarounds proposed\"\n      adequate: \"Recovery discussed but timeline unclear\"\n      needs_improvement: \"Overcommitted on timeline or ignored business impact\"\n```\n\n### Step 5: Generate After-Action Report\n\n```yaml\nafter_action_report:\n  exercise: TTX-2024-Q1 \"Operation Dark Harvest\"\n  date: 2024-03-22\n  participants: 10\n  duration: 3 hours\n\n  executive_summary: >\n    The tabletop exercise tested the organization's ransomware response capabilities\n    across detection, containment, communication, and recovery phases. The SOC team\n    demonstrated strong technical triage skills but gaps were identified in cross-\n    functional communication and backup recovery procedures.\n\n  strengths:\n    - SOC analysts correctly identified ransomware indicators within first inject\n    - Containment decision-making was swift and technically sound\n    - Legal team was well-prepared on breach notification requirements\n    - IT operations had clear understanding of backup recovery procedures\n\n  gaps_identified:\n    - gap_1:\n        finding: \"No documented procedure for notifying CISO after-hours\"\n        risk: High\n        action: \"Update escalation contacts with personal phone numbers and backup contacts\"\n        owner: SOC Manager\n        due_date: 2024-04-05\n\n    - gap_2:\n        finding: \"Backup recovery testing has not been performed in 6 months\"\n        risk: Critical\n        action: \"Schedule quarterly backup restoration drill\"\n        owner: IT Operations Lead\n        due_date: 2024-04-15\n\n    - gap_3:\n        finding: \"No pre-approved media holding statement for cyber incidents\"\n        risk: Medium\n        action: \"Draft and approve 3 holding statement plugins with Legal\"\n        owner: Communications Lead\n        due_date: 2024-04-10\n\n    - gap_4:\n        finding: \"Service account (svc_backup) had Domain Admin privileges unnecessarily\"\n        risk: Critical\n        action: \"Audit all service accounts, implement least privilege\"\n        owner: IT Security\n        due_date: 2024-04-01\n\n    - gap_5:\n        finding: \"Unclear decision authority for ransom payment\"\n        risk: High\n        action: \"Document ransom payment decision tree with CEO\u002FBoard approval requirement\"\n        owner: CISO\n        due_date: 2024-04-15\n\n  metrics:\n    overall_score: \"72\u002F100 (Adequate)\"\n    detection: \"85\u002F100 (Excellent)\"\n    containment: \"80\u002F100 (Good)\"\n    communication: \"60\u002F100 (Needs Improvement)\"\n    recovery: \"65\u002F100 (Needs Improvement)\"\n\n  next_exercise: \"TTX-2024-Q2 — Data Breach \u002F Insider Threat Scenario (June 2024)\"\n```\n\n### Step 6: Track Remediation and Follow-Up\n\n```spl\n--- Track action items from tabletop exercise\n| inputlookup ttx_action_items.csv\n| eval days_remaining = round((strptime(due_date, \"%Y-%m-%d\") - now()) \u002F 86400)\n| eval status_flag = case(\n    status=\"Completed\", \"GREEN\",\n    days_remaining \u003C 0, \"RED — OVERDUE\",\n    days_remaining \u003C 7, \"YELLOW — DUE SOON\",\n    1=1, \"GREEN\"\n  )\n| sort - status_flag, days_remaining\n| table gap_id, finding, owner, due_date, days_remaining, status, status_flag\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Tabletop Exercise** | Discussion-based simulation where participants walk through incident scenarios without executing technical actions |\n| **Inject** | Scenario update introducing new information, complications, or decisions for participants to address |\n| **Hot Wash** | Immediate post-exercise debrief where participants share observations and initial lessons learned |\n| **After-Action Report (AAR)** | Formal document capturing exercise findings, gaps, strengths, and remediation action items |\n| **Facilitator** | Exercise leader who presents injects, guides discussion, and ensures objectives are met |\n| **Decision Point** | Moment in the scenario requiring participants to choose between options with trade-offs |\n\n## Tools & Systems\n\n- **FEMA HSEEP**: Homeland Security Exercise and Evaluation Program providing exercise planning methodology\n- **Tabletop Exercise Framework (NIST SP 800-84)**: NIST guide for planning and conducting IT security exercises\n- **Immersive Labs**: Platform for cybersecurity crisis simulation and tabletop exercise management\n- **Infection Monkey**: Open-source breach simulation for technical validation of tabletop findings\n- **Archer**: GRC platform for tracking exercise findings and remediation action items\n\n## Common Scenarios\n\n- **Ransomware Attack**: Multi-phase scenario testing detection, containment, ransom decision, and recovery\n- **Data Breach**: Customer PII exposure testing notification requirements, legal obligations, and PR response\n- **Supply Chain Compromise**: Third-party vendor breach impacting organizational systems and data\n- **Insider Threat**: Employee data theft scenario testing HR, Legal, and security team coordination\n- **Business Email Compromise**: CEO fraud wire transfer attempt testing financial controls and verification procedures\n\n## Output Format\n\n```\nTABLETOP EXERCISE SUMMARY — TTX-2024-Q1\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nScenario:     Operation Dark Harvest (Ransomware)\nDate:         2024-03-22 (09:00-12:00 UTC)\nParticipants: 10 (SOC: 5, IT: 1, Legal: 1, Comms: 1, Exec: 2)\nDuration:     3 hours (6 injects delivered)\n\nSCORES:\n  Detection & Triage:    85\u002F100  Excellent\n  Containment:           80\u002F100  Good\n  Communication:         60\u002F100  Needs Improvement\n  Recovery Planning:     65\u002F100  Needs Improvement\n  Overall:               72\u002F100  Adequate\n\nKEY FINDINGS:\n  [+] Strong: Ransomware indicators correctly identified immediately\n  [+] Strong: EDR isolation procedure well understood\n  [-] Gap: No after-hours CISO notification procedure\n  [-] Gap: Backup recovery untested for 6 months\n  [-] Gap: No pre-approved media statement templates\n  [-] Gap: Service account over-privileged (Domain Admin)\n  [-] Gap: Ransom payment decision authority undefined\n\nACTION ITEMS: 5 (Critical: 2, High: 2, Medium: 1)\nNEXT EXERCISE: TTX-2024-Q2 (June 2024) — Insider Threat Scenario\n```\n",{"name":5,"tags":49,"capec":52,"model":53,"tools":54,"domain":43,"maxTurns":58,"nist_csf":59,"subdomain":64,"description":7,"mitre_attack":65},[39,27,28,50,40,51,29],"incident-response","nist",[],"sonnet",[55,35,56,57],"Read","Glob","Grep",20,[60,61,62,63],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations",[66,67,68],"T1566","T1486","T1078","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fsoc\u002Fexercise\u002Ftabletop\u002Fexecute\u002Fexploit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill exercise-tabletop-execute-exploit",{"tool":82,"command":83},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill exercise-tabletop-execute-exploit",{"tool":85,"command":86},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill exercise-tabletop-execute-exploit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsoc\u002Fexercise\u002Ftabletop\u002Fexecute\u002Fexploit\u002FSKILL.md",true,[90],{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"index.json","REFERENCE","参考文档",706,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsoc\u002Fexercise\u002Ftabletop\u002Fexecute\u002Fexploit\u002Findex.json",[97,121,142,163,185,201],{"skillNo":98,"name":99,"nameZh":6,"description":100,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":103,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[104,105,106,107,108,109,33,110,111,112,113,114,115,116,117,118,119,43,120],"services","detect","services wmi persistence detect","wmi","persistence","de","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[25,104,128,107,129,130,131,43,35,132,133,134,135,136,109,137,138,139,140,141],"services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":148,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[149,150,151,152,153,154,43,35,155,132,156,157,109,139,158,159,160,161,162,53],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":169,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[105,170,171,172,173,174,175,33,176,43,120,177,178,179,180,181,182,183,184,109],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":191,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[192,193,105,194,172,174,195,33,196,176,43,120,132,197,198,199,200,184,109,110],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":207,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[208,105,172,209,195,33,210,211,43,120,212,213,214,215,216,217,109,110,218,219],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]